Cross-source coverage

T1090.001 / ATT&CK

Proxy: Internal Proxy

12 rules across 4 sources.

From MITRE ATT&CK 19.2

Adversaries may use an internal proxy to direct command and control traffic between two or more systems in a compromised environment. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN, ZXProxy, and ZXPortMap. Adversaries use internal proxies to manage command and control communications inside a compromised environment, to reduce the number of simultaneous outbound network connections, to provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between infected systems to avoid suspicion. Internal proxy connections may use common peer-to-peer (p2p) networking protocols, such as SMB, to better blend in with the environment.

By using a compromised internal system as a proxy, adversaries may conceal the true destination of C2 traffic while reducing the need for numerous connections to external systems.

Tactics: Command and Control
Platforms: ESXi · Linux · macOS · Network Devices · Windows
Telemetry: WinEventLog:SysmonWindows Firewall Logauditd:SYSCALLNSM:ConnectionsNSM:Flowmacos:unifiedlogmacos:osqueryesxi:shellesxi:vmkernelFirewall Audit Logsnetworkdevice:cli

How MITRE says to detect it DET0075

Internal Proxy Behavior via Lateral Host-to-Host C2 Relay

Windows Analytic 0204

Anomalous process (e.g., `rundll32`, `svchost`, `cmd`) initiates connections to internal peer hosts not seen in typical communication baselines, used to proxy or forward traffic internally, often using SMB, RPC, or high ports.

WinEventLog:Sysmon EventCode=3, 22
WinEventLog:Sysmon EventCode=1
Windows Firewall Log SMB over high port

Linux Analytic 0205

`socat`, `ssh`, `iptables`, or `ncat` invoked from user space or cron jobs to create port forwarding, reverse shells, or inter-host tunnels between compromised Linux systems. Behavior is typically paired with socket activity and high entropy traffic.

auditd:SYSCALL execve
NSM:Connections Internal connection logging
NSM:Flow conn.log

macOS Analytic 0206

Execution of AppleScript or Automator services launching `ssh -L`, `socat`, or `launchctl` items that dynamically reroute traffic from one Mac endpoint to another. LaunchAgents used to establish permanent internal tunnels.

macos:unifiedlog None
NSM:Flow pf firewall logs
macos:osquery Process Events and Launch Daemons

ESXi Analytic 0207

ESXi shell execution of tools/scripts (`nc`, `socat`, `perl`) relaying network traffic to other internal hosts, especially when initiated by unauthorized users or VMs.

esxi:shell /var/log/shell.log
esxi:vmkernel /var/log/vmkernel.log
NSM:Flow conn.log

Network Devices Analytic 0208

Configuration of internal NAT or proxy rules that redirect traffic between client segments internally (e.g., site-to-site port forwarding). Often used to relay internal beaconing or move traffic laterally through trust zones.

Firewall Audit Logs Config Change
NSM:Flow Inter-segment traffic
networkdevice:cli Policy Update

View on attack.mitre.org ↗

SigmaHQ/sigma

6 rules

Detection	Severity	Format
HackTool - SharpChisel Execution	High	Sigma
PUA - Chisel Tunneling Tool Execution	High	Sigma
RDP over Reverse SSH Tunnel WFP	High	Sigma
Renamed Cloudflared.EXE Execution	High	Sigma
Cloudflared Portable Execution	Medium	Sigma
Cloudflared Quick Tunnel Execution	Medium	Sigma

elastic/detection-rules

2 rules

Detection	Severity	Format
Port Forwarding Rule Addition	Medium	Elastic TOML
IPv4/IPv6 Forwarding Activity	Low	Elastic TOML

socfortress/Wazuh-Rules

2 rules

Detection	Severity	Format
Possible proxy usage with curl detected (MITRE T1090.001)	High	Wazuh XML
Proxy environment variable set — possible redirection attempt (T1090.001)	High	Wazuh XML

splunk/security_content

2 rules

Detection	Severity	Format
Windows Proxy Via Netsh	Undefined	SPL
Windows Proxy Via Registry	Undefined	SPL